Conversation Participants Content Text ContentType 
9/21/2016] 18:07:18 : text/html 


9/21/2016] 18:10:02|From: asands To: cpape pretty good! director level interest in the new case | just got so | am [Message text/html 
basically halting on everything else and being Curtis's lackey. pretty 


cool 

9/21/2016| 18: essage 
9/21/201 ; essage 
9/21/201 essage 
9/21/201 From: asands To: cpape essage 
9/21/201 essage 
9/21/2016 
2465 
2466 7th floor interest!! Message 
2467 Ah... Fair enough, well at least the day is working out! Message 
3044] 9/22/2016| 19:09:35|From: jjhubiak To: asands_|____________________ |Mediastart 
3048| 9/22/2016| 19:15:46|From: jjhubiak To:asands_|__________ |MediaEnd ia:Audi 
83 From: asands To: cmoravec 
327 MediaStart ia:Audi 
3277| 9/23/2016| 13:25:20|From: asandsTo:jjhubiak | Response | 
3278| 9/23/2016] 13:25:20|From: asandsTo:jhubiak [| |mie 
3279| 9/23/2016] 13:25:20|From:asandsTo:jhubiak_ | Response ____ | 
3280] 9/23/2016] 13:25:20|From:asandsTo:jhubiak {| | 

3 F z ij i i j £ 


tem # 
2457 
2458 


245 
24 

24 
246 
246 


Q 
Oo 


nn 
BB 
am 


Y z 


N 

N 
n 
D 


N 
a 


N 
aim 


nn 


nvite 


| 2465] 
| 3044] 
| 3048 
6 
| 3281] 


32. 9/23/201 From: asands To: jjhubiak good morning josh! 
3282| 9/23/2016| 13:25:20|From: asands To:jjhubiek_|___________________  [MediaStart medias | 


9/23/2016] 13:26:06|From: asands To: jjhubiak central dynamics, the registrant for the trump-email.com domain, is [Message 
pa willing to cooperate with the FBI and provide logs, so | do not think m) 
we will need to contact Listrak at all 
3284 Thanks for your help thus far and | appreciate any insights you have 
moving forward 


3285| 9/23/2016| 13:28:57 |From: caheide To: asands 
3364| 9/23/2016] 13:53:49|From: jjhubiak To: asands 


9/23/2016] 13:53:49|From: jjhubiak To: asands roger that, let me know if you need anything else. godaddy, we essage 
think, would have some good intel as well. 


00 
oO 


Nie 
an 


Ww 
N 
val 
OQ) 


eS ea 


3366| 9/23/201 From: jjhubiak To: asands 
33 9/23/201 From: jjhubiak To: asands 
33 9/23/201 3 rom: jjhubiak To: asands 


ia] 


w 
w 
n 
n n 


n 
001 
ia] 


am 


33 9/23/201 


[ea] 


13 


F 

From: jjhubiak To: asands Response | 
33 14:22:42|F 
33 | 9/23/2016| 14:24:43] From: rmherbster To: asands icati 

F 

Ñ 


am 


ES o a] 
wjojw 
[a] 


” 


33. 9/23/2016] 14 0} From: rmherbster To: asands 
3438] 9/23/201 :28|From: asands To: jpientka 
3439| 9/23/2016] 15:31:28|From: asands To: jpientka 


AID 


w 
am 


SCO_FBIPROD_016017 


SCO-073878 
SCO-3500U-017263 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0001 


¡de 9/23/2016| 15:31:28|From: asands To: jpientka | have an update for you, please let me know when you have a text/html 
minute to talk 


| 341] 9/23/2016] 15:31:28]From:asandsTo:jpientka | finite [fapplication/sdp OE 
From: asandsTo:jpientka | [Response | 
[From: asands To: jpientka | Response | | 
| 3aaa] 9/23/2016|15:41:28|From: asands To: jpientka | SessionEnd G ë | 
From: asands To: jpientka | ________________________ fsessionena________|_ | 
[Erom: asandsTo:jpientka | Medindia 
| a47o| 9/23/2016|16:09:52[From: caheide To:asandss | Response [|| 
9/23/2016 [From: caheide To:asands_ | Response _______|__________ |] 
9/23/2016 [From: caheide To: asands | _________________________  [MediaStart  [mediaim __ | 
A e nn ooo __] 
3474| 9/23/2016 From: caheide To:asands | iwite | 


3475| 9/23/2016| 16:09:52 Hor caheide To: asands once we get that case opened, let's cut a lead to the MM division, |Message -m 
requesting assiting with the interview, etc. 

3476| 9/23/2016] 16:10:06] From: caheide To: asands then they can cover it. we'll need to add them as case participants text/html 
and all that 


| 3477| 9/23/2016] 16:10:11|From:caheideTo:asands | Sessionnd | 
a a ee 
5/23/2016 
9/23/2016 a rrr rrr 
Losi E cc ("TRENES 
i O "A E 
| 38016] 16:13:01 From: rear To: 5294 rete [moplcatifede | 
Sapo 
nn e 
Spray fooi 0 oo ooo—————————— e E 
9/23/2016 


3488| 9/23/2016| 16:18:21|From: rcgaynor To: asands Ok, | have to leave my desk. CD AD asked me to do a check-in on essage == 
the server matter (any update) before a meeting he has this 
afternoon where the information would be useful (Time TBD). | will 
be back in 30 minutes or so to try and get in touch with you again. 


| aso] 9/23/2016|16:28:21|From: regaynor To:asands | f[Medind [mediaim | 
9/23/2016 [From: regaynor To:asands | [Sessioninma e ë | 
| 3491| 9/23/2016|16:28:21|From: regaynor To:asands | Sessionnd =P 
9/23/2016 [Erom: asandsTo:caheide | invite fapplication/sdo | 
9/23/2016 From: asandsTo:caheide | Response |] 
[From:asandsTo:caheide | invite | |] 
| 3496] 9/23/2016] 16:43:41[From:asandsTo:caheide [Response | 
| 3497| 9/23/2016] 16:43:41[From:asandsTo:caheide [I MeediaStart [medias | 


SCO_FBIPROD_016018 


SCO-073879 
SCO-3500U-017264 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0002 


3498] 9/23/2016] 16:44:28] From: asands To: caheide | lifted the “logs” from the low side...Im going to ask Kyle to take a [Message text/html 
log at them and write up an assessment for me so | can serial the 
email from central dynamics too 


| 3499| _ 9/23/2016] 16:54:28|From:asandsTo:caheide | _________________________ esio | _______ | 
| 3soo| 9/23/2016] 16:54:28]From:asandsTo:caheide | Session ___ | 
| 3so1] 9/23/2016] 16:54:28]From:asandsTo:caheide | Median [mediam | 
From: caheide To:asands | invite [application/sdp_ | 
l apparently missed a call to HQ this morning at 8 
9/26/2016 From: asands To: cpape man, Im so tired too 
9/26/2016 From: asands To: cpape dont let me volunteer for anything else 
e iSessionend | 
O AA e CIS NES 
| as7a| 9/26/2016| 13:53:24]From:asandsTo:cpape | Medindia | 

3574 aa AA A _| 


3575| 9/26/2016| 13:54:05|From: cpape To: TE yes ma'am.. although | didn't think you were volunteering anyway. text/html 


|__3576|_9/26/2016| 13:54:05|From:cpapeTo:asands | Repone |_______ 
A A A O ad 
Epa 05 C INN 7. T VEN 
9/26/2016 05 eo ee 
pr pe at eee a ea hone 
E 9/26/2016] 13:54:50fFrom:rmherbster To: asands just saw curtis email om thelow side _{Message_] ext/h z 
ext/html 

3583 ET q ext/html 


3584| 9/26/2016] 13:55:08|From: SER To. cpape m even though Im the case agent | am still totally expendable ext/html 


9/26/2016 From: asands To: cpape but yet Im still in trouble for not being on it ext/html 
9/26/2016 From: asands To: cpape and thus even more expendable ext/html 
3587| 9/26/2016 From: asands To: cpape bad way to start the week ext/html 


3588] 9/26/2016] 13:55:35] From: rmherbster To: asands |i'll reach out for them again this morning, headed to a meeting right ext/html 


9/26/2016 From: asands To: rmherbster Mia give me a call if you have any questions text/html 


3590| 9/26/2016 From: cpape To: asands wow... a whole lot of WTF in that situation... I'm sorry to hear that ext/html 


| aso1] 9/26/2016|13:57:47|From: caheide To: asands | invite [application/sdp | 
9/26/2016 From: asandsTo:jhubiak | fiites pp] 
| 3678| 9/26/2016] 15:28:42|From:asandsTo:jhubiak | Response  ___|_____ | 
[3679| 9/26/2016] 15:28:42|From:asandsTo:jhubiak | Response ___|__________ | 
|__3680|_ 9/26/2016] 15:28:42|From:asandsTo:jhubiak | fMediaStare media | 


SCO_FBIPROD_016019 


SCO-073880 
SCO-3500U-017265 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0003 


3682| 9/26/2016] 15:28:42|From: asands To: jjhubiak [| invite fapplication/sdp 


9/26/2016] 15:29:46|From: asands To: jjhubiak Im writing a justification for an NSL to GoDaddy and | would Message text/html 

appreciate a sanity check. | havent sent an NSL to GoDaddy before 
for anything but subscriber data and | want to be sure | am framing 
my request correctly and requesting data that will actually be 

3709| 9/26/2016] 15:32:11|From: jjhubiak To: asands i dont know if this is what you are referring to but basically, you Message text/html 
want from GoDaddy all subscriber information, all domains and sub- 
domains created by that subscriber, ip log history, billing 
information that are related to the domain "trump-email.com" 


| 3710| 9/26/2016| 15:34: z From: asands To: jjhubiak yeah that helps, thanks :) e ooo oa 
—=Ñ 9/26/2016 From: asands To: jjhubiak also, NSL for lisktrak heading your way Message __] ex text/html ë = 
9/26/201 From: jjhubiak To: asands k, i will let harrisburg know ext/html 


9/26/2016] 15:35:28|From: asands To: jjhubiak the end user is willing to provide logs but they dont have what we ext/html 
need. 
4 


From: jjhubiak To: asands roger that /html 
/html 

A 5 i /html 
rzezie do you want to read over this NSL justification? /html 
/ntml 
/html 


/html 
/html 


| 9/26/2016] From: caheideTo:asands ok, [Message text/nt el 


9/26/2016] 18:22:40|From: rmherbster To: asands |i just forwarded you an email from cendyn about one IP that was essage ext/html 
attempting to contact the server 


| 9/26/2016] From: rmherbster To: asands |the li was blocked [Message |text/html 


ext/html 


ext/html 
ext/html 


SIF E 3 ; 3 t 
3905| 9/26/2016 From: asands To: rmherbster text/html 
3906| 9/26/2016| 18:28:03|From: asands To: rmherbster [anything else you need from us? text/html 


9/26/2016| 18:28:45|From: rmherbster To: asands |do you want me to classify this as unclass/fouo or does it need to 
be secret? 


SCO_FBIPROD_016020 


SCO-073881 
SCO-3500U-017266 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0004 


3908] 9/26/2016] 18:29:02|From: rmherbster To: asands |i'm on the crim squad, im not good w the whole classification thing text/html 
lol 


| 3909| 9/26/2016| 18:29:13] From: dwkeiser To: asands__|Will do. l'II head up in a minute Message text/html | 
From: rmherbster To: asands | Sessionen S S O 
O2|From: rmherbster To: asands | sessionen S S E 
| 3o13| 9/26/2016| 18:39:12[From: dwkeiser To: asands_ | ____________________ fSessionend____|_____ | 
|From: dwkeiser To: asands | Medindia | 
From: dwkeiser To: asands | Session | 
| 3916| 9/26/2016] 18:50:29|From: asands To:rmherbster | Response _[|___ | 
9/26/2016 29|From: asands To: rmherbster |the overall case file is s//nf so no worries 
From: asands To: rmherbster | invite appplication/sdp >| 
9/26/2016 From: asands To: rmherbster | [MediaStat media | 
O a 2 pa Y 
Te E 
Tai. 38 anything that ties alfa bank to trump is S//NF 
9/26/2016 but your interviews should be all unclassified ex TE 
9/26/2016 fouo ext/h 
—— — still has to approve those NSLs ext/h 
ext/h 
par z COO O B (11177 RENE media: 
9/26/2016 (From: asands To: caheide | ___________________________[Sessionend___|_____ | 
li o l EN 
ext/html 


9/26/2016 
2/26/2016 
| ah 20001] sao 2398 —| 2 ss eT 
apps i From: caheide To:asands | invite _______[|___________| 
E e 
Lee T |From: caheide To:asands | limite lepplicationm/sdp_ | 

ps 


9/26/2016 From: caheideTo:asands | fRespome _____ | 
9/26/2016 From: caheide To:asands_|____________________________ [Mediana medam | 
EE 9|From: caheide To:asands | Sessionend S ë | 
E O A E 
aa 24 
9/26/2016 O O a a (7771 DES 
9/26/2016 [From: caheideTo:asands | fimite_______  fepplicatiom/sdp | 
9/26/2016 From: caheide To:asands__|________________________ [mie ___ | | 


4011| 9/26/2016] 20:05:26|From:caheideTo:asands | Response  ___|___________ | 


9/26/2016 
9/26/2016 
9/26/2016 
9/26/2016 


From: caheideTo:asands [| Response _|__ |] 
From: caheide To:asands | k[Sessionima S | 
[From: caheide To:asands | essione o o | 
| 4018] 9/26/2016] 20:10:16]From:asandsTo:dswierzbicki[ Response _____|____________| 


No. 1:21-cr-00582-CRC (D.D.C.) 


SCO_FBIPROD_016021 


SCO-073882 


SCO-3500U-017267 


DX-546_0005 


2019} 26/2016 20:10:18 Srom: ssands To: dewerztida ____finwite__appication/sdp_] 
el a TE T 1 E 
TE 5 00000 rrr OO E 
O ST 
From: asands To: dswierzbicki| invite 
18|From:asandsTo:dswierzbicki| o oo [esiones S Ee 
From: asands To: dswierzbicki| o oo [Mediana [mediam | 
18|From:asandsTo:dswierzbicki| o o [Sesiones S | 
From: asands To: Imschambach 
From: asands To: Imschambach 
9/26/2016 From: asandsTo:Imschambach SS [Sessionend___|___ | 
9/26/2016 From: asands To: Imschambach Response i (sd 
9/26/2016 arom asands To: Imschambac|bah! ok, thanks Lisa. appreciate your help 

4071 s/26/2016 | Miri DIN MediaStart media ———t 
| 4072| 9/26/2016] 22:02:11|From:jjsooTo:asands | invite fepplication/sdp | 


4073 e PMF EN ay jjsoo To: asands Searching the current and historical lists of Tor exit nodes published |Message text/html 
by the Tor Project (torporject.org) covering the time period of May 
4 2016 - Sept 4 2016, no matches of the Spectrum Health IP 
(167.73.110.8) were found. Normally, a Tor exit node would appear 
in this list if it were active during the reveiwed time period. Under 
normal conditions, the historical data used for searching is captured 
at a a rate of once per hour, every hour, every day. 


4074| 9/26/2016] 22:02:11] From: jjsoo To: asands OOOO te CY] 
4075| 9/26/2016| 22:02:12|From: jjsoo To: asands IA == E 
4076| 9/26/2016 From: jjsoo To: asands O ES e ë k 


4077| 9/26/2016] 22:06:27 |From: asands To: jjsoo | want to add something like this: This is further evidence thatthe [Message text/html 
white paper?s claim about SPECTRUM HEALTH being an exclusive 
exit node for ALFA BANK is not supported by technical 
analysis. Further, the use of Tor networks is inconsistent with 
Russia?s TTPs for obfuscating its network activities. 


4078| 9/26/2016] 22:06:34] From: asands To: jjsoo do you agree with that statement text/html 


4079| 9/26/2016] 22:09:22|From: jjsoo To: asands | would agree that is true. You could however make the more Message text/html 
general statement of "This is further that the white paper's claim 
about ... being an exit node -- exclusive or otherwise -- is not 
supported by technical analysis. 
anonymity. 


9/26/2016] 22:13:43 
9/26/2016] 22:13:50] From: asandsTo:jjsoo his, Message text/html 


SCO_FBIPROD_016022 


SCO-073883 
SCO-3500U-017268 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0006 


| 4o8a| 9/26/2016|22:18:44|From: jjsoo To:asands___|______ SessionEnd | 
From: jjsoo To:asands___|_____________________ [Mediana medias | 
| 4086| 9/26/2016] 22:18:44|From:jjsooTo:asands YO [Sessionen S | E 
| 5315| 9/29/2016|19:56:55|From: jpientka To: asands | o [MediaStat  [media:Audio | 
E  _  _ _ _————— >> applet | 
A o A 
ME O O A 
A E DEN VEN 

[Erom: asands To: jpientka | > fSessionina | |] 

9/29/2016 From: asands To:jpientka | invite application/sdp | 

e Herom: ssands To: peng L oo eose y SN 


9/29/2016 TOO E O E "(INN EEN 

9/29/2016 71 e) |, |] 
| 9/29/2016] 19:87-22] From: peta To: ande | ed fed 
[$320] 9/29/2016] 19:57:22] From: jpientka To: sipasands | on] 
i O O E 
9/29/201 From: jpientka To: asands_ | fsessionena_______|_ |] 
9/29/2016| 1 rom:asends To:ipientig o |__| 
9/29/2016 1 [From:asandsTo:jpientka [Median media O 
10/4/2016] 1 [From: sjhellmanTo:asands | invite application/sdp > | 

1 a] 

1 

1 


10/4/201 From: EIA To: asands [hey Allison essage text/h 
10/4/201 From: sjhellmanTo:asands | invite S o O 


10/4/2016| 13:24:25|From: sjhellman To: asands | 222 [Mediasta media:IM 


N 


10/4/2016] 1 essage text/html 
10/4/2016] 1 From: sjhellmanTo:asands | Response e 
10/4/2016] 1 Eon helman 19422990 AAA 
al 
1 


w 


P 


n 


oe ext/html 

i on dhemen Te aan re sia you gushed more deonta vee text/html 

10/2016 ext/html 

TE text/html 

Ee AG e nese re ext/html 
6220 i 7 A 
6222 AER ext/html 
6223| 10/4/2016 ext/html 
6224| 10/4/2016 From: sjhellman To: asands 
6225| 10/4/2016 


10/4/2016 From: asands To: sjhellman jhe may be referring to 2 random IP addresses we got from tom text/html 
grasso 


SCO_FBIPROD_016023 


SCO-073884 
SCO-3500U-017269 


a oa 


am 
SISISISIa 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0007 


6227| 10/4/2016] 13:26:47|From: asands To: sjhellman Jahyes, Message text/html 


6228] 10/4/2016] 13:27:05|From: asands To: sjhellman fone of those IP addresses is alfa bank, the other is some home IP text/html 
address in moscow 

6229] 10/4/2016] 13:27:24|From: asands To: sjhellman  |we are going through the logs you sent and including those two text/html 
additional IPs. 


6230| 10/4/2016| 13:27:31|From: asands To: sjhellman _ |! think its a big nothing sandwich text/html 


6231| 10/4/2016| 13:28:07|From: asands To: sjhellman — [sorry, not the logs you sent, the logs we received from central text/html 
dynamics 


6232| 10/4/2016| 13:28:32|From: asands To: sjhellman fwe are going through and looking for any Alfa bank activity at all, Message 
but we got a report on the Alfa Bank side that they also think this is 
nothing 


/html 
the logs | sent /html 
Sp 20/8/2016] 13:29:34 from: acond Ta: sjhellman | sent that to you just now /html 

are also absurd and worthless as we discussed before lol /html 
w/a yes /html 

/html 
10/8/2016 [orale song now /html 
10/4/2016 [From: sjhellman To: asands — [oh nice you found tyhe "source?" /html 


From: asands To: sjhellman essage /html 


From: asands To: sjhellman essage /html 
From: sjhellman To: asands Message /html 
From: A T asands essage /html 
/html 


10/4/2016 E E ext/html 


nuam eS ext/html 
| 10/4/2016] text/html 
From: Heller To: asands j ext/html 
From: asands To: sjhellman Message text/html 
10/4/2016 [From: sjhellman To: asands _ [lolol 


6252| 10/4/2016] 13:31:32|From: asands To: sjhellman  |we have the findings, adn teh answer is, "this is nothing" ext/html 
6253| 10/4/2016| 13:31:38|From: sjhellman To: asands _ {absurd they paid $80k Message text/html 


10/4/2016] 13:31:45|From: asands To: sjhellman but yet, we are still going through the logs and doing due dilligence text/html 


10/4/2016 From: asands To: sjhellman _ |yes, completely absurd (A 
10/4/2016| 13:31:58|From: asands To: sjhellman _ || think we are underpaid, haha [Message Jtext/html | 


6267| 10/4/2016| 13:34:34]From: asands To: sjhellman if you dont mind, | may ask you to take a look at the results of our |Message TEN 
analysis of the logs and check to make sure we arent missing 
anything 


SCO_FBIPROD_016024 


SCO-073885 
SCO-3500U-017270 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0008 


| ahve one of our computer scientists going through it now, but U 
dont know if we are just trying to disprove the claims in the 
whitepaper or look for anything suspicious. if we find anything | 
would aprpeciate a second opinion. 


6268] 10/4/2016] 13:35:29] From: asands To: sjhellman 


“ 


6278] 10/4/2016} 13:36:07|From: kdsteere To: asands Morning Allison! Message text/html 


ml 
ml 


6279] 10/4/2016] 13:36:18] From: asands To: kdsteere | would love to get an assessment on them before this hits the press text/ht 


6280| 10/4/2016] 13:36:20] From: sjhellman To: asands [couple of end goals 


but always our job is to collect information, and make decisions 
about its authenticity which we then use to make more decisions (ie 


6282] 10/4/2016] 13:36:51] From: sjhellman To: asands 
10/4/2016] 13:37:08] From: asands To: kdsteere 


6286 
6288 
6289| 10/4/2016] 1 


6294| 10/4/2016] 13:39:10] From: asands To: kdsteere so just so we are on the same page, please look for/ analyze any 
CES actiivty on those six IP addresses and well as any other "suspicuious 
activity" 
someting 


10/4/2016 40 


Scott Hellman is available to answer any questions you have and 
will provide a second opinion on any results you find itneresting or 


10/4/2016| 13:37:23|From: kdsteere To: asands Yup, | hear ya. They are the first thing on my list for today. 
Apparently my passwords expired lastnight, so l'm gettting those 


sorted and them l'm on it. 


13:37:28 
1 


10/4/2016] 1 


10/4/201 
10/4/2016 


From: sjhellman To: asands 


10/4/2016 


p 
o 
— 
E 
ne, 
N 
is) 
= 
oY o 


essage 


essage 


essage 


essage 


essage 


/h 


ex ml 
ml 


ml 


/h 
ext/html 
text/html 


ext/html 


From: asands To: sjhellman [thanks again for all your help text/html 


6297| 10/4/2016] 13:40:12] From: asands To: kdsteere your report will be my justification for closing so be sure not to miss |Message text/html 
anything and ask for help if you need it, lol 
6298] 10/4/2016] 13:40:16] From: asands To: kdsteere Jason can help too text/html 


6322| 10/4/2016] 13:43:22|From:sjhellmanTo:asands | o o ive lapptication/sdp 
6323] 10/4/2016| 13:43:22|From: sjhellman To: asands  |lol no problem [Message text/html 


No. 1:21-cr-00582-CRC (D.D.C.) 


SCO_FBIPROD_016025 


SCO-073886 


SCO-3500U-017271 


DX-546_0009 


| 6324] 10/4/2016] 13:43:22| From: sjhellman To: asands [> [MediaStar [mediam | 

| 6325| 10/4/2016| 13:43:22|from: sjhellmanTo:asands_| fimite o | 

From: sjhellman To: asands | Response ___|_________| 

| 6328l 10/4/2016|13:43:37|From: sjhellman To: asands | Repone | | 
repurcussions if you mess it up ....take those opportunities 

From: asandsTo:kdsteere | Response o 

From: asandsTo:kdsteere | invite o 


6399 GITT 14:00:56 Ga asands To: kdsteere how many logs are there for you to go through? and how long will it |Message text/html 
take o | need to give HQ an update 


From: asands To: kdsteere 
oe A EE 
os 6[From:asandsTo:kdsteere | MediaStart medias | 
0/20) 10509 on ese: [rte tip 
LTTE 02 ro: kstere To: ands [Frege EA 
10/4/2016 From: kdsteereTo:asands | [MediaStat  [medieim_ ___ | 
10/4/2016 Po 2 ass E 
SUE A [Hing td 
Sorry, | was on Green side without lync. ext/htm 


6493 ADEE ET From: TE To: eaten from HQ: Did the preliminary screen of the logs against the ?new essage ext/h 
anonymous? reporter information on the person of interest?s 2 IP 


addresses find any hits? 
94| 10/4/2016] 15:07:15] From: kdsteere To: asands So here's the quicky: If | follow correctly, we asked for logs essage jh 


concerning a specified mx server (mail1.trump-email.com) as well 


as the logs showing the 


ae a O ext/html 
DARDS ouno oo M e Í A — /html 
10/4/2016 ext/html 
10/4/2016 


649 10/4/2016| 15:11: a From: deere To: asands If you just need a quick answer: No. The logs | have do not show any|Message ext/html 
activity from the ‘anonymous report' ipa 


E 10/4/2016} 15:11:10 From kdsteere To: asandi [Ohi Thought you were gone Message __ftext/htrmt | 
10/4/2016 rst MEN EEN 
10/4/2016 [From: kdsteere To: asands [| [Sessionima o | 
10/4/2016 [From: kdsteere To: asands [| [Mediand [mediaim_ O 
| esti] 10/a/2016|16:01:50|From: kdsteere To:asands |  [MediaStart medias | 
10/4/2016 From: kdsteere To: asands [| fine fapplication/sdo | 
10/4/2016 50|From: kdsteere To: asands_ |! know what those logs are and the spectrum -if want to know___ [Message_________ [text/html | 
| 6514| 10/a/2016| 16:01:50|From:kdsteereTo:asands | Response | 
| ésas] 10/4/2016] 16:01:50|From:kdsteereTo:asands | invite __|_____ | 
|__6516| 10/4/2016] 16:01:50|From:kdsteereTo:asands_ | Response | 
| 6517] 10/4/2016] 16:01:56]From:asandsTo:kdsteere ido! Message text/html | 


SCO_FBIPROD_016026 


SCO-073887 
SCO-3500U-017272 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0010 


[6521] 10/a/2016|16:09:52|From: kdsteere To: asands_|_____ SessionEnd _|___ | 
| 6522 10/4/2016] 16:09:52[From:kdsteereTo:asands_ | SessionEnd _|__ | 
(From: kdsteere To: asands_|___________________________—[Mediand____ [medieim_ _ | 
| 6524| 10/a/2016|16:14:34|From: asands To: kdsteere | invite | | 
| és2s| 10/a/2016|16:14:34[From: asands To: kdsteere | invite [application/sdp | 
| 6526| 10/4/2016] 16:14:34|From:asandsTo:kdsteere | k[MediaStat medias | 
4 

From: asands To: kdsteere | Response | | 
| 6529| 10/a/2016|16:14:35|From: asands To: kdsteere | frespomse | | 
[EromsasandsTo:kdstere {Session | 


10/4/2016 


10/4/2016 


10/4/2016 
10/4/2016 
10/4/2016 


10/5/2016| 13:55:26|From: cdtrifiletti To: asands _ |can you take a lync call? 


TE 


= 
26|From: cdtrifiletti To: asands 


iTo: asands 


From: cdtrifiletti To: asands 


or] e T 
text/html 


PO ivite ap ication/sdp 


rom: EET To: asands _ [7 A 


ispoke with jessie, she will advise you text/html 


essage 


text/html 


10/5/2016 
— 


DO 


i To: asands 
i To: asands 
i To: asands 
i To: asands 
i To: asands 
use asands 


From: cdtrifi 


rari cdtrifiletti To: asands 


From: cdtrifiletti To: asands 


708 
708. 
708 
708 


18:15: 30 From: cdtrifiletti To: asands 


18:15:48] From: cdtrifiletti To: asands 


SessionEnd 


Po Medizin medic | 
Po fSessioneng E 
PO ivite fapplication/sdp | 
ns | tT 


essage 
me IES 


Response 


text/htm 


ia:IM 


essage 


essage 


essage 


2 
3 
7 
8 
7 


10/5/2016 
10/5/2016 


10/5/2016 


18:19:13] From: asands To: cdtrifiletti 


ok, great thanks Chris Message 


6|From: asands To: cdtrifiletti__|this is top priority for me today and | appreciate your help Message 
49|From: cdtrifiletti To: asands text/html 


18:20:34|From: cdtrifiletti To: asands 


i reminded him once more that he has never proceeded with 
anything when he wasnt absolutely sure and asked him to proceed 
with caution and open ears 


Message 


No. 1:21-cr-00582-CRC (D.D.C.) 


text/html 


text/h 


SCO_FBIPROD_016027 


SCO-073888 
SCO-3500U-017273 


DX-546_0011 


7123| 10/5/2016] 18:22:27|From: asands To: cdtrifiletti eah, | really think he is wrong text/html 
7124| 10/5/2016] 18:22:39|From: asands To: cdtrifiletti |i was very worried he had some data we didnt text/html 


7125| 10/5/2016] 18:22:59|From: asands To: cdtrifiletti {but assuming we all have the same info, his analysis is liekly wrong text/html 
7126| 10/5/2016] 18:23:30|From: cdtrifiletti To: asands {hopefully washpo will save him from himself and wont publish essage text/html 
without full corroboration 


10/5/2016] 18:23:47|From: cdtrifiletti To: asands [they have held off since at least sunday, must be for that reason, essage 


right? 


10/5/2016| 18:24:18|From: asands To: cdtrifiletti essage 


10/5/2016| 18:24:36|From: asands To: cdtrifiletti__ [which Im sure is why the DNS queried the new host name 


7130| 10/5/2016] 18:25:01|From: asands To: cdtrifiletti {nut just logicailly, if you are seting up a covert channel you dont do |Message 
it with your open IP 


10/5/2016| 18:25:07|From: asands To: cdtrifiletti__ [and this is just NOT what the Russian gov does 


7132| 10/5/2016] 18:25:22|From: cdtrifiletti To: asands  |yes, you told me about the take, wish there was a way to telegraph |Message 
that to him better 


33| 10/5/2016| 18:25:28|From: cdtrifiletti To: asands  |but you said what you could essage 
34] 10/5/2016] 18:25:45|From: asands To: cdtrifiletti essage 


35] 10/5/2016] 18:25:57|From: cdtrifiletti To: asands essage 


36| 10/5/2016] 18:26:09|From: cdtrifiletti To: asands |in that trying to determine what russia does, is that all they ever do jh 
From: cdtrifiletti To: asands [or are they trying other things now that look more non traditional ext/html 


3 eech roms stands Tasearimend | [Response J] 

m 10/ 6/2016] 19:17:38 AA Resp a 
AE ES a | 
A A e 


aa 19:17 : From. asands To. cdtrifiletti  |hey Chris, we found that the trump1.contact-client.com IS in the Message text/html 
original report done by Alfa Bank 


10/5/2016| 19:17:38|From: asands To: cdtrifiletti | invite fapplication/sdp 
10/5/201 From: asands To: cdtrifiletti _ [which is why they pinged it 


Wia 10/5/2016| 19:18:13|From: asands To: cdtrifiletti again, all of that "suspicious acvity" is a result of the subsequent text/html 
investigation 


From: cdtrifiletti To: asands__|ok on with inspection now, will get back with you asap 
Bea From: cdtrifiletti To: asands _ e 2 TT 
10/5/2016 aa ———S AAA 


SCO_FBIPROD_016028 


SCO-073889 
SCO-3500U-017274 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0012 


24 


From: cdtrifiletti To: asands 


From: cdtrifiletti To: asands 
From: cdtrifiletti To: asands 
Seer cdtrifiletti To: asands 


essage text/html 


Response} _ —  —_—_ | 
Po y y y y o Media 
a O 


10/5/2016 From: cdtrifiletti To: asands _ |i have family obligations at 5 so have to get out on time today text/html 


10/5/2016] 2 


7424| 10/5/2016 


al 
2 


39|F 
8 


10/5/2016] 2 


10/5/2016] 21:08:31 


10/5/2016 
10/5/2016 


—+ 
10/5/2016 
74 


rom: cdtrifiletti To: asands 


From: asands To: cdtrifiletti 


rom: asands To: cdtrifiletti 


From: asands To: cdtrifiletti 


From: asands To: cdtrifiletti 


From: cdtrifiletti To: asands 


74 


From: cdtrifiletti To: asands 


74 


EERE 
10/5/2016 
10/5/2016 
10/5/2016 


i To: asands 
iTo: asands 
iTo: asands 


From: cdtrifi 


i To: asands 
i To: asands 
From: cdtrifiletti To: asands 
From: asands To: cdtrifiletti 


O 
10/5/2016 
10/5/2016 
—— 


Era 


10/5/2016 T 


EE 


From: asands To: cdtrifiletti 


From: cdtrifiletti To: asands 


rom: cdtrifiletti To: asands 
From: cdtrifiletti To: asands 
Hron cdtrifiletti To: asands 


rom: - cdtrifiletti To. asands 
rom: cdtrifiletti To: asands 


From: cdtrifiletti To: asands 


sorry i know you must be busy texte 


sorry, ive been on the phone literally since we hung up with you text/htm 


reuters is El over dint too ext/html 
Sa 
sent the info out to a few people at HQ 

We need to speak to Dave dagon now too, so if you can write up Message 


the notes tomorrow it would be MUCH appreciated. otherwise | can 
try and do it later tonight 


ml 


/h 


essage 


/h 
/h 
/h 
/h 


then if nothing new today, i can just reference the dns txt files he ml 


sent 


essage ext/html 


nvite application/sdp 


S-00030038-A-061.pdf piera A 
i TR NT 
e a S 
ss e TS 
oo... Mediae media File Transfer | 


essage ext/html 
essage ext/html 


text/html 


eS 7 
PO Sessionend | 
ext/html 


heading out, pls call if you need anything else today, mobile S| | 


IREDACTED /403 


7448] 10/5/2016| 21:57:44|From: cdtrifiletti To: sands | invite fapplication/sdp 


44 


No. 1:21-cr-00582-CRC (D.D.C.) 


From: cdtrifiletti To: asands 


Pe O [Response sd 


SCO_FBIPROD_016029 


SCO-073890 
SCO-3500U-017275 


DX-546_0013 


7450| 10/5/2016| 21:57:44|From: cdtrifiletti To: asands [invite 
7451| 10/5/2016| 21:57:44|From: cdtrifiletti To: asands | _________________ [MediaStart 


7573| 10/6/2016| 16:48:49|From: asands To: cdtrifiletti  |sure! yesterday: SSA Dan Wierzbicki, SA Allison Sands, Kyle Steere {Message text/html 
(CS), Jason Soo (Con) , ti Jessie Eisenbart (1A) 


7574| 10/6/2016 From: asands To: cdtrifiletti |today: Kyle Steere (CS), Jason Soo (Con), SA text/html 
David Vos 


7575| 10/6/2016] 16:49:36] From: asands To: cdtrifiletti |the guccifer chatter makes no sense at all, confirmed that with my |Message text/html 
team here, but an FBI leak would probably be of interest 


prom: edtrtfletti To: asand L __ffewitg_saptication/sdp _] 
10/6/2016 

sss a So o 
A E E 
10/6/2010 eons Yo. aan [Sng oon /htm 


10/6/2016 rom: TE To: sip: cdtrifilett Leave 


7701| 10/7/2016| 1 From: asands To: jfstofer if you would still liketo chat after the brief this monring please let [Message 
me know. im here all day 


10/7/2016 good morning, no problem 
10/7/2016 
10/7/2016 
10/7/2016 
SITE 

7708 aaa 


7709| 10/7/2016| 12:45:31|From: jfstofer To: asands or you can just ping me on IM later once your done...but if you essage /h 
a give me a rough timeframe when you'll be free that would be 


10/7/2016 From: asands To: jfstofer we are meeting at 9:00 your time and it usually lasts about 30-45 ext/h 
minutes 


10/7/2016 ext/h 
Eee : : i ia:Audi 
10/12/2016 
10/12/2016 From:asandsTo:caheide | mite [| |] 
10/12/2016 [From: asands To: caheide [| [Response | 
10/12/2016 [From: asands To: caheide [|  |Mediastart = medias | 
10/12/2016 
10/12/2016 


F E i E . ar t 

6 From: asands To: caheide the "logs" we got from listrak were not network logs 
10/12/2016] 13:02:53|From: caheide To: asands ok. that's not good 
10/12/2016] 13:03:21[From: asands To: caheide |  |Mediafna 


SCO_FBIPROD_016030 


SCO-073891 
SCO-3500U-017276 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0014 


8019] 10/12/2016] 13:03:21|From:asandsTo:caheide | TC Sessionend | 
8020| 10/12/2016] 13:03:21|From:asandsTo:caheide [| Cf SessionEnd | | 
8021| 10/12/2016] 13:03:54[From: asands To: caheide_|_____________________finite____ lapplication/sdp 


8022| 10/12/2016| 13:03:54|From: asands To: caheide you should have them one the green side, but they basically just Message text/html 
confirm that trump org is one of their email clients, but they dont 
show destination email addresses or IPs or anything that we can 
use todetermine any communications 


| goza| 10/12/2016] 13:03:54|From: asandsTo:caheide | Response ____ | | 
| goza] 10/12/2016] 13:03:54|From: asandsTo:caheide | Response ______ | | 
| 8o2s| 10/12/2016| 13:03:54|From: asands To: caheide_|________________________fiwite _____|_____ | 
| 8o26| 10/12/2016| 13:03:54[From: asands To: caheide_|___________________________ [Mediastart media: | 
yeah, that's not useful at all 
| 8o28| 10/12/2016] 13:04:27|From: caheide To: asands__|i think i might have perused them 
From: asands To: caheide it was two excel spreadsheets 
that was all we got 
| 8031| 10/12/2016] 13:07:43] From: caheide To: asands__| this is good times.... 
| 8o32| 10/12/2016] 13:07:45|From: caheide To: asands |) Message textfntml | 
| 8033| 10/12/2016] 13:07:48|From: asands To: caheide | o Í|Sessiominda____ | | 
| 8034| 10/12/2016] 13:07:48|From: asands To: caheide | Medien [mediaim O 
| 8035| 10/12/2016| 13:07:48|From: asands To: caheide | _______________________ esio S S | 
| 8044| 10/12/2016| 14:15:51[From: keclinesmith To:asand] TT Response ___|______ | 
| sos] 10/12/2016] 14:15:51]From:keclinesmithTo:asands| Response __|_______ | 
| 8046] 10/12/2016] 14:15:51|From: keclinesmith To: asand| invite application/sdp OU 


8047 a 12: 15: z From: kechnesmith To: asands| Allison, can you send me the Alpha Bank "white paper" by chance? | |Message ext/html 
can't locate the copy Sally sent me for some reason. 


das [14:15:51] rrr A ae 
[oso] 10/12/2016] 14:15:51] From: kecinesmith To: asands[_ [te] __ 
10/12/2016 
| sosa] 10/12/2016] 15:48:54[From:alichielloTo:asands | [Mediasta medias | 
| 8084| 10/12/2016] 15:48:54[From:alichielloTo:asands [invite [application/sdp | 


8085| 10/12/2016] 15:48:54|From: alichiello To: asands Hello Agent Sands, My name is Anna and | am an evidence tech at |Message ext/html 
the NVRA (WFO). | had an item of evidence collected and charged 
into my office last week. | have been in contact with SSA Batty. Per 
his lead, | am putting the evidence in the mail today via FED EX. | 
will email you the tracking number once it's been generated 


10/12/2016| 15:48:54|From:alichielloTo:asands | invite ___|_____ | 
10/12/2016] 15:48:55|From: alichiello To:asands | Response ___|__________ | 
8088] 10/12/2016| 15:48:55|From: alichiello To:asands [Response __|_ | 


SCO_FBIPROD_016031 


SCO-073892 
SCO-3500U-017277 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0015 


| 8090| 10/12/2016] 15:59:28|From: alichielloTo:asands | __________________________ Meediend media | 
| goga| 10/12/2016] 15:59:28|From: alichiello To:asands | SessionEnd | ___ | 
| gssol 10/19/2016] 13:02:01|From: asands To: caheide | _______________________ Sessionen S oo | 
| 8860] 10/19/2016] 13:02:01|From: asands To: caheide | Median media | 
| ass1| 10/19/2016] 13:02:01|From: asands To: caheide | ____________________ fsessionend [| ____ | 
MESA AE O O 
| 8863| 10/19/2016] 13:05:03|From:asandsTo:caheide | S  [MediaStart medias | 
a eee T 


8865| 10/19/2016] 13: “05: male From: ET To: caheide | dont have much to say, so IIl keep it short. just that we spoke to essage ext/h 
bos mandiant and that we are talkingt o the tech people at the ISP 
toda: 
a 
paper are unfounded 


9| 10/19/2016 9|From: caheide To: asands that's fine. you're good with that ext/h 


8870| 10/19/2016| 13:05: a From: caheide To: asands you're doing great. if you want to help out with some stuff on this ext/h 
visitor you definitely can 


[Erom: caheide To: asands | good jp _ _ __———_ job ext/h 
ext/h 
ext/h 
text/h 
ext/h 


10/19/2016] 13:13:12|From: caheide To: asands yeah no kidding. hey dude.... we just told you.... we think it's bunk ext/h 


10/19/2016 
[9274| 10/19/2016] 19:54:32|From: kdsteere To: sip:asands| oi OOOO] 
| 9a7s| 10/19/2016] 19:54:32[From: kdsteere To: sip:asands| oi o ë 
| 9276| 10/19/2016] 19:54:33|From: kdsteere To: sip:asands| in e ë E 
| 9277| 10/19/2016| 19:54:33|From: kdsteere To: sip:asands| in e ë E 
| 9278] 10/19/2016| 19:54:33|From: kdsteere To: sip:asands| in e E 
| 9279] 10/19/2016| 19:55:07|From:asandsTo:kdsteere | fSessionina S y | 
| 980| 10/19/2016] 19:55:07|From:asandsTo:kdsteere [| SessionEnd | 
| gasa] 10/19/2016] 19:55:07|From:asandsTo:kdsteere | Medien [mediaim___ | 
| 9282| 10/19/2016] 19:57:33|From:asandsTo:kdsteere | Response ——— 
| gasa] 10/19/2016] 19:57:33]From:asandsTo:kdsteere | Response | 


SCO_FBIPROD_016032 


SCO-073893 
SCO-3500U-017278 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0016 


| 9284] 10/19/2016] 19:57:33] From: asandsTo:kdsteere [invite application/sdp |] 
| _ 9285| 10/19/2016] 19:57:33|From:asandsTo:kdsteere [invite 
| _ 9286| 10/19/2016] 19:57:33|From:asandsTo:kdsteere | [Mediasta medias | 
| 9290| 10/19/2016] 19:58:07|From: dwkeiser To: asands | Sessionend | f 
| 9291| 10/19/2016] 19:58:07|From: dwkeiser To: asands | Sessionend | 2-22] 
| 9292| 10/19/2016] 19:58:07|From: dwkeiser To: asands_ | [ediand [medi 


9304 [40/15/2016] 19-56-30] From: kastesre 50 a 


| 9306| 10/19/2016] 20:03:57|From:asandsTo:kdsteere | [Response | |] 
| _ 9307| 10/19/2016] 20:03:57|From:asandsTo:kdsteere | [mite [| |] 
| ___ 9308| 10/19/2016] 20:03:57|From:asandsTo:kdsteere | Response | | 
|___9309] 10/19/2016] 20:03:57|From:asandsTo:kdsteere | [Mediasta medias | 
| _ 9310| 10/19/2016] 20:03:57|From:asandsTo:kdsteere | invite appication/sdp E 
| 9321| 10/19/2016] 20:09:10|From:kdsteereTo:asands [kT [Message eeo | 


9322| 10/19/2016| 20:09:37|From: dwkeiser To: asands I'm meeting her at the side door to the SCIF on 8 at 330, if you want [Message text/html 
to join, if not I'll fly solo 


| 9329| 10/19/2016] 20:10:21]From:asandsTo:kdsteere | oo esio __[|______ | 

| a33o| 10/19/2016] 20:10:21]From:asandsTo:kdsteere | oS  [Mediaend media | 

| e331| 10/19/2016] 20:10:21]From:asandsTo:kdsteere | Session SP 
4 


AJF ñ : sip: 
9335| 10/19/2016] 20:10:38|From: kdsteere To: sip:asands 
9336| 10/19/2016] 20:10:38|From: kdsteere To: sip:asands 


SCO_FBIPROD_016033 


SCO-073894 
SCO-3500U-017279 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0017 


7| 10/19/2016] 20:10:38|From: kdsteere To: sip:asands| Cites ST 
| 9338| 10/19/2016] 20:10:38|From: kdsteere To: sip:asands| o ooo odee | | 
| 9339] 10/19/2016| 20:10:43]From: asands To: dwkeiser and when in doubt, docvument everything Message ]|t text/html 


So | heard "don't do anything crazy, and if you do, don't get 
caught," is that right...? ;-) 

your trump email case got a 1-2 paragraphs in a headline story on 
the NYT's today (in case you didn't know 


9340| 10/19/2016| 20:11:15|From: dwkeiser To: asands 
9991| 11/1/2016| 14:08:03|From: jjsoo To: asands 


poa 
ae 


11/1/2016] 14:08:03] From: jjsoo To: asands E H A, 
11/1/2016] 14:08:03| From: jjsoo To: asands pee | a ee 


— 11/1/2016| 14:08:10|From: asands To: rcgaynor good morning, please let me know if you have a min for a qucik chat|Message text/html 
before SS 11am meeting 


11/1/2016 
aeu 
| didnt, thanks 

ae its the main story on Slate 

11/1/2016 Ok, on with CyD, how about 10:45? Anything stick out? 

11/1/2016 Moving on up 

ar thanks 

no, nothing at all 

TTT i? 
11/1/2016 25 


From: asands To: rcgaynor 


11/1/2016 Fo From: aani: To: regaynor = headline i is that the allegation is "debunked" 
11/1/2016] 14:12:30] From: asands To: regaynor 
~ 11/1/2016| 14:12:33|From: regaynor To: asands ACA 


For sure. It was cool to read about your work while having 
breakfast lol 


11/1/2016] 14:12:51|From: jjsoo To: asands 


11/1/2016 From: regaynor To: asands | will print the NYT and hold it up as a prop for the AD;s tex 


11/1/2016| 14:13:10|From: asands To: jjsoo oh, | thought you meant you were moving the article to the high 
side 


essage 


essage 


Response |__| 
From: asands To: regaynor ee 


: 
ml 
ml 
ml 
ml 
ml 
ml 


ex 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 
ext/h 


/h 


ml 
ml 
ml 
ml 


ml 
ml 


/h 
/h 


ex 


| 10014] 2/1/2018 Masa prom asands To: jjsoo C ext 


tl 
o 
11/1/2016 
(a eorn] 


O B (7.7 EEN 771 IEEE 
O A RS MN 
[From: asands To: regaynor [| kfSessionema" S | 
EE O session MENESES WN 


11/1/2016] 14:23:43| From: jjsoo To: asands PO Mediz mediam |] 


0021| 11/1/2016 


From: jjsoo To: asands ee on => 


0022| 11/1/2016| 14:24:13|From: rcgaynor To: asands that story must be buried on NYT or my search skills have gotten text/html 
weak 


11/1/2016] 14:24:13|From: regaynor To:asands_|_____________________ fmwite ____|_ E 
11/1/2016] 14:24:13|From: regaynor To: asands | |Mediastart 
oo25| 11/1/2016] 14:24:13]From: regaynor To: asands [Response ___|__________ | 


No. 1:21-cr-00582-CRC (D.D.C.) 


SCO_FBIPROD_016034 


SCO-073895 


SCO-3500U-017280 


DX-546_0018 


10026| 11/1/2016| 14:24:13|From:regaynorTo:asands_ | Response | 
10027] 11/1/2016| 14:24:13] From:regaynorTo:asands_ | invite application/sdp 


From: cdtrifilettiTo:asands [Response | 


10177| 11/1/2016] 20:02:00| From: catrifiletti To: asands | MediaStar 


10178} 11/1/2016] 2 00} From: cdtrifiletti To: asands |greetings, my chs checked in to see if anything is needed on the dns text/html 
stuff 


TTT 2 


From: cdtrifiletti To: asands | invite | | 
From: cdtrifiletti To: asands A A A AA<<<===— — —  —>= 


11/1/2016] 20:02:00|from: cdtrifiletti To: asands | limite [application/sdp 


11/1/2016 From: asands To: cdtrifiletti {thanks for circling back. 


11/1/2016| 20:09:28|From: asands To: cdtrifiletti |I think we are close to closing this. | have a few more logs to 


11/1/2016| 20:09:56|From: asands To: cdtrifiletti [thanks for the heads up tho- 


11/1/2016| 20:10:06|From: asands To: cdtrifiletti — |*slate.com 


19) 11/1/2016| 20:10:10|From: cdtrifiletti To: asands 
11/1/2016| 20:10:51|From: cdtrifiletti To: asands 


0202| 11/1/2016] 20:13:12|From: asands To: cdtrifiletti 


11/1/2016 
11/1/2016 
cana 


when that piece came out last night, we had already addressed 
every claim in it, made us look on top of our game :) 


0182| 11/1/2016| 2 37|From: cdtrifiletti To: asands |i told chs prob not, that it looks like newspapers were reaching the 
conclusion that it is inconclusive 


definitely prove there are no emails, and then Im putting it to bed 


m 


essage 


‘a inal 


ext/html 


html 


essage 


essage 


essage 


/h 


essage 


essage 


From: cdtrifiletti To: asands 
rom: cdtrifiletti To: asands el 
From: asands To: kdsteere A O 


O = 5 From: asands To: kdsteere | invite [application/sdp 


on 


1806 dee 17:45:21|From: asands To: kdsteere 


rom: ands ae [ite EEE A 
[From:asandsTo:kdsteere | 0 [Mediastart media O 
lFrom:asandsTo:kdsteere | Response __|_______ | 


No. 1:21-cr-00582-CRC (D.D.C.) 


On Friday, September 30, 2016, REAGAN GERENA, Director of Message text/html 
Interactive Design and Development, Cendyn One, 980 N. Federal 
Highway, Boca Raton, Florida 33423, provided log files related to 
the en IP addresses: 217.12.97.15 217.12.96.15 167.73.110.8 
.218.13 


From: kdsteere To: asands T E T re sec.. text/rtf 
05] From: asands To: kdsteere ok thanks text/html 


SCO_FBIPROD_016035 


SCO-073896 
SCO-3500U-017281 


DX-546_0019 


11809] 11/14/2016] 17:52:03] From: kdsteere To: asands On Friday, September 30, 2016, REAGAN GERENA, Director of Message text/rtf 
Interactive Design and Development, Cendyn One, 980 N. Federal 
Highway, Boca Raton, Florida 33423, provided log files related to 
the following IP addresses. This was in response to FBI inquiries 
resulting from reporting by an unknown source that a server on 
CENDYN’s network was communicating with Russian based ALFA 
BANK. 
217.12.97.15 
217.12.96.15 
167.73.110.8 
50.207.241.6 
79.134.218.13 
The provided log files were as follows: 

Attachment 1: SEE Ties cico-asa.csv 


816] 11/14/2016] 18:00:14] From: kdsteere To: asands That’ S ior the first EC. The aana one would be br the Listrak essage text/rtf 
domain stuff that they sent us after our phone interview with them 


ee 18:01: = From: ARRE To: asands done, buk it wouldn't let me sign, only collaborate without signing N 


11/14/2016 43| From: asands To: kdsteere | Sessionend |  i 
aan 43]From: asands To: kdsteere |  — ooo o fesional 
AA ON e frecistt 
TAE O e A 
11/14/2016 [Erom: kdsteere To: asands[ok____________________ [Message Mee | 
11/14/2016 lfrom:kdsteereTo:asands [invite  fapplication/sdo | 
11/14/2016 [Erom: kdsteere To: asands | ______________________________B—[MediaStart media | 
11/14/2016 [Erom: kdsteere To: asands | Response | | 
Ene 31[From: kdsteere To: asands | [mite [| |] 
BECO 1/10/2010] FAEN kastere To: asands | ena E 
TA e A | 
11/14/2016 [Erom: kdsteere To: asands | Median [mediaim O 
11/14/2016 From: dswierzbicki To: sanas] MediaStart ____ k[media:Audio | 
Glau eke 12|From: dswierzbicki To: asands | [Mediana OO [media:Audio | 
o E RS ENEE 
SEE E [Erom: caheide To:asands__|___________________________ [Respome_____|_ |] 
e [Erom: caheide To:asands | invite | | 
ME A [ i T 
|__ 14219] 11/28/2016] 21:16:13|From: caheide To: asands | MediaStart medias | 


See 21:16:13 From: caheide To: asands can you do a change case request for ALFA and add Brian Auten 
from HQ? 


SCO_FBIPROD_016036 


SCO-073897 
SCO-3500U-017282 


No. 1:21-cr-00582-CRC (D.D.C.) DX-546_0020 


11/28/2016| 21:16:22|From: asands To: caheide 


11/28/2016] 21:16:43|From: caheide To: asands he's got something hitting off of it and wants to see what you have. 
14225| 11/28/2016] 21:17:12 |From: caheide To: asands hit me up when it's in there and i'll ahve dan push it through quick. [Message 
he's the SIA at LAA oo over all this stuff 


po Session nd | 


“3h amaral To asands [Median 


20/8010] 21.1713 Fm: eaheide ot asande —| nta | 
| 14229] 11/28/2016| 21:17:45|From:asandsTo:caheide | Response 
AAA O O Ua 
| 14231] 11/28/2016] 21:17:45|From:asandsTo:caheide | |[MediaStare  [mediaim____ | 


O 21:17: = From: asands To: caheide | was able to add him as a case participant in the Manage case qucik 
edit 


3| 11/28/2016] 21:17:45|From:asandsTo:caheide | invite | 


nvite 


4| 11/28/2016| 21:17:45|From: asands To: caheide ÚS 


11/28/2016] 21:17:55 |From: caheide To: asands 
6| 11/28/2016 34 18:02|From: asands To: caheide he should be able ot access it now 
7| 11/28/2016 [21:18:02 From: caheide To: asands i'll hit him up and see if he can get in there 


8| 11/28/2016 Ae on From: asands To: caheide ok 


12/27/2016 5|From: kdsteere To: asands Hey. Just out of curiosity, is that Trump/Cendyn case ever gonna get 


? 
4] 12/27/2016 6|From: kdsteere To: asands 


closed or do cases just sit in Sentinel indefinitely...? 


12/27/2016] 20:58:26|From: asands To: rblear no 


Response eee | 


12/27/2016| 20 22[From:asands To Katee 


text/html 


| 17287] 12/27/2016| 20:58:28|From: kdsteere To: asands [:P”_ Message textfrtf | 
| 1823] 1/4/2017| 16:15:34|From:asandsTo:saparsons_ [| |Mediastare ST [media/Audio | 
|__ 18446] 1/4/2017| 16:16:03|From: asands To: saparsons | [Mediana [medialAudio | 
| 19691] 1/6/2017| 18:15:41|From:saparsonsTo:asands_[ | MeediaStart ______ [media/Audio | 
| 1969] 1/6/2017| 18:21:59|From: saparsons To: asands | [Mediaend  [medialAudio | 


No. 1:21-cr-00582-CRC (D.D.C.) 


SCO_FBIPROD_016037 


SCO-073898 


SCO-3500U-017283 


DX-546_0021 


